Deception is moving at machine speed. Learn to keep pace.
Portal LoginSupportBlogContact
Search
Portal LoginSupportBlogContact
Search
Get a Demo
Start for Free
HomeAuthors
James Maclachlan
James Maclachlan profile picture

James Maclachlan

Staff Detection Engineering & Threat Hunting AnalystHuntress

James Maclachlan is a dedicated cybersecurity professional with a knack for uncovering threats and responding to incidents. His passion for cybersecurity was sparked at a young age after a malware infection while downloading Minecraft mods, and it grew into a career during his time at the University of Warwick, where he earned an MSc in Cybersecurity Engineering. James also holds certifications like eCTHPv2 and eCMAP, showcasing his expertise in threat hunting and malware analysis.

Before joining Huntress, James honed his skills in Security Operations at Mandiant and Google. At Huntress, he thrives on the mission of protecting businesses of all sizes from cyber threats, hunting APTs, and uncovering zero-days.

Outside of work, James enjoys web development, drumming, and playing ice hockey. He’s a strong advocate for password managers, unique passwords, and 2FA.

Explore his insights on his blog: blog.jaalma.io.


Blog Posts By This Author

Read more about Insights into Suspected DPRK Workers: Red Flags to Look Out For
Insights into Suspected DPRK Workers: Red Flags to Look Out For
Blog Post

Insights into Suspected DPRK Workers: Red Flags to Look Out For

Huntress analyzed several incidents involving DPRK remote workers (Famous Chollima) in partner environments. Learn key indicators to detect and prevent North Korean threats.

Read more about Exploitation of Windows Server Update Services Remote Code Execution Vulnerability (CVE-2025-59287)
Exploitation of Windows Server Update Services Remote Code Execution Vulnerability (CVE-2025-59287)
Blog Post

Exploitation of Windows Server Update Services Remote Code Execution Vulnerability (CVE-2025-59287)

Huntress observed threat actors exploiting a Microsoft WSUS remote code execution vulnerability across four customers within days of disclosure. Here's the timeline, the TTPs, and why you need to patch now.

Read more about Active Exploitation of Gladinet CentreStack and Triofox Local File Inclusion Flaw (CVE-2025-11371)
Active Exploitation of Gladinet CentreStack and Triofox Local File Inclusion Flaw (CVE-2025-11371)
Blog Post

Active Exploitation of Gladinet CentreStack and Triofox Local File Inclusion Flaw (CVE-2025-11371)

A local file inclusion flaw in Gladinet CentreStack and Triofox was actively exploited before a patch existed. Huntress documented the vulnerability, the exploitation activity, and what to do now.

See All Blog Posts by James Maclachlan

Featured In These Upcoming Events & On-Demand Virtual Events

Read more about Stories from the SOC: Meet the DE&TH Team
Stories from the SOC: Meet the DE&TH Team
On-Demand Virtual Event

Stories from the SOC: Meet the DE&TH Team

Whether you are an MSP or an internal IT leader, you need to know who has your back. We are giving you direct access to the analysts behind our threat hunting, showing you exactly how they think, how they hunt, and how they handle the threats that automated alerts miss.